{"id":25616,"date":"2024-12-27T11:20:54","date_gmt":"2024-12-27T19:20:54","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2024\/12\/27\/news-19345\/"},"modified":"2024-12-27T11:20:54","modified_gmt":"2024-12-27T19:20:54","slug":"news-19345","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2024\/12\/27\/news-19345\/","title":{"rendered":"Prioritizing patching: A deep dive into frameworks and tools – Part 1: CVSS"},"content":{"rendered":"

Credit to Author: Matt Wixey| Date: Fri, 27 Dec 2024 17:33:53 +0000<\/strong><\/p>\n

\n

Back in August 2022, Sophos X-Ops published a white paper on multiple attackers<\/a> \u2013 that is, adversaries targeting the same organizations multiple times. One of our key recommendations in that research was to prevent repeated attacks by \u2018prioritizing the worst bugs first\u2019: patching critical or high-profile vulnerabilities that could affect users\u2019 specific software stacks. While we think this is still good advice, prioritization is a complex issue. How do you know what the worst bugs are? And how do you actually prioritize remediation, given that resources are more or less the same but the number of published CVEs per year continues to increase<\/a>, from 18,325 in 2020, to 25,277 in 2022, to 29,065 in 2023? And according to recent research<\/a>, the median remediation capacity across organizations is 15% of open vulnerabilities in any given month.<\/p>\n

A common approach is to prioritize patching by severity (or by risk,<\/em> a distinction we\u2019ll clarify later) using CVSS scores. FIRST\u2019s Common Vulnerabilities Scoring System<\/a> has been around for a long time, provides a numerical ranking of vulnerability severity between 0.0 and 10.0, and is not only widely used for prioritization but mandated in some industries and governments, including the Payment Card Industry<\/a> (PCI) and parts of the US federal government<\/a>.<\/p>\n

As for how it works, it\u2019s deceptively simple. You plug in details about a vulnerability, and out comes a number which tells you whether the bug is Low, Medium, High, or Critical. So far, so straightforward; you weed out the bugs that don\u2019t apply to you, focus on patching the Critical and High vulnerabilities out of what\u2019s left, and either patch the Mediums and Lows afterwards or accept the risk. Everything is on that 0-10 scale, so in theory this is easy to do.<\/p>\n

But there\u2019s more nuance to it than that. In this article, the first of a two-part series, we\u2019ll take a look at what goes on under the hood of CVSS, and explain why it isn\u2019t necessarily all that useful for prioritization by itself. In the second part, we\u2019ll discuss some alternative schemes which can provide a more complete picture of risk to inform prioritization.<\/p>\n

Before we start, an important note. While we\u2019ll discuss some issues with CVSS in this article, we are very conscious that creating and maintaining a framework of this type is hard work, and to some degree a thankless task. CVSS comes in for a lot of criticism, some pertaining to inherent issues with the concept, and some to the ways in which organizations use the framework. But we should point out that CVSS is not a commercial, paywalled tool. It is made free for organizations to use as they see fit, with the intent of providing a useful and practical guide to vulnerability severity and therefore helping organizations to improve their response to published vulnerabilities. It continues to undergo improvements, often in response to external feedback. Our motivation in writing these articles is not in any way to disparage the CVSS program or its developers and maintainers, but to provide additional context and guidance around CVSS and its uses, specifically with regards to remediation prioritization, and to contribute to a wider discussion around vulnerability management.<\/p>\n

What is CVSS?<\/h1>\n

CVSS is \u201ca way to capture the principal characteristics of a vulnerability and produce a numerical score reflecting its severity,\u201d according to FIRST<\/a>. That numerical score, as mentioned earlier, is between 0.0 and 10.0, giving 101 possible values; it can then be turned into a qualitative measure using the following scale:<\/p>\n